Post-AiTM session theft: new MFA method, OAuth grant, or inbox rule
Detects high-risk account modifications, such as adding MFA methods or OAuth consent grants, occurring shortly after a user sign-in. This pattern is indicative of post-AiTM session theft (e.g., NovaCookies) where an adversary uses a stolen session token to modify account settings for persistence or MFA bypass.
Microsoft Sentinel (KQL)
